Vulnerability · Published Oct 12, 2026 · Assigned by Neo4j

CVE-2026-92682@neo4j/graphql: authorization relationship and connection filters invert the "none" quantifier

High 8.6

In plain English

A high-severity incorrect authorization in @neo4j/graphql from Neo4j. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 24% of all known vulnerabilities).

Severity (CVSS 4.0)8.6High

Exploit odds (30 days)0.3%top 75.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

In @neo4j/graphql versions from 7.0.0 up to but not including 7.6.4, the none quantifier in @authorization filters on relationships and connections is not negated when translated to Cypher, so it behaves like some. A rule such as "none of the related denied users matches the JWT subject" therefore returns exactly the records it was meant to exclude, and excludes those it was meant to return. An authenticated user whom such a rule is meant to deny can read the protected records. This is also the case for mutations, so the impact is that sensitive data could also be created and deleted by users that shouldn't have access according to the typedefs. Fixed in 7.6.4.

Affected products (as reported)

Vendor	Product	Versions
Neo4j	@neo4j/graphql	7.0.0 – before 7.6.4

Weakness: CWE-863 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

References

GHSA-h873-p2wr-fjx6 vendor-advisory
Fix commit 17650cc patch
@neo4j/graphql 7.6.4 release notes release-notes
https://www.npmjs.com/package/@neo4j/graphql product